New attack method targets Oracle databases
Even all 1,449 security patches couldn't prevent this attack
1Oracle's record patch release
In July 2023, Oracle released a massive 1,449 security patches at once. However, the new attack method detected by Huntress couldn't be prevented by any of these patches. According to cybersecurity expert Craig Savage, even a fully patched system remained vulnerable to this attack. This situation demonstrates that security patches alone aren't sufficient protection.
2Attack beginning with SQL injection
The attack started with a 'simple' SQL injection against an undisclosed organization's web application. While SQL injections are known and preventable attack vectors, the subsequent stages of this incident were unusual. After gaining initial access, attackers uploaded a toolkit called 'khunt' into the Oracle database.
3Java source code loading vulnerability
The attackers exploited Oracle database engine's ability to load code objects directly. Thanks to Oracle's embedded Java Virtual Machine (JVM), it's possible to store Java source code as database objects. This technique (oraexec) was theoretically known but rarely seen in practice. Attackers sent CREATE JAVA SOURCE commands to Oracle via Tomcat.
4Misconfiguration in production server
According to Savage from Spinnaker Support, Oracle has its own JDK and can create/run Java programs within the database. However, this feature shouldn't be accessible to a web server. In production environments, it should be locked and only temporarily enabled during development or maintenance windows. In this case, the system was misconfigured.
5Need for DBA-exclusive privileges
Savage emphasizes that Java execution privileges in the database should be limited to Database Administrator (DBA) users only. Code compilation should be disabled on production servers. Had this precaution been taken, attackers couldn't have compiled their Java code. This highlights the importance of basic security measures.
6Cybercriminals' new tactics
Savage notes that cybercriminals are increasingly exploiting legitimate system functionalities rather than just seeking vulnerabilities. They understand how these products work. Despite Oracle releasing nearly 1,450 patches, basic security measures shouldn't be neglected. This incident serves as a wake-up call for the industry.
7Oracle's official statement
Oracle officials don't classify this incident as an 'Oracle breach'. They attribute the issue to poorly configured and unsecured systems. However, experts warn about potential risks of Oracle databases' embedded JVM feature. Such features need careful management, especially in large-scale enterprise use.
8Important lessons for the industry
This incident demonstrated that relying solely on patches isn't enough for software security. Basic security measures, proper configuration, and privilege management are crucial. Organizations using Oracle databases should review their Java features. In an era of increasingly sophisticated attack methods, continuous defense strategy updates are essential.